Special Edition is the blog for security testing business SE Labs. It explains how we test security products, reports on the internet threats we find and provides security tips for businesses, other organisations and home users.

Wednesday, 15 February 2017

17 Things Spammers Get Wrong


No one publishes successful phishing and ransomware emails. Jon Thompson thinks he knows why.

The headlines say phishing scams are at an all-time high, and ransomware is growing exponentially, but conspicuous by their absence are examples of the emails behind successful attacks. It's becoming the cliché in the room, but there may be a reason: embarrassment.


Running an email honeypot network, you receive a flood of malicious email every day. Most is littered with glaring errors that point to lazy, inarticulate crooks trying to make the quickest buck from the least effort. When you do come across a rare, well though-out campaign, it shines like a jewel in a sea of criminal mediocrity.

To the average spammer, however, it's all just a numbers game. He cranks the handle on the botnet, so to speak, and money comes out.

This poses an important question: why, given the quality of most malicious spam, are new ransomware infections and high profile phishing attacks still making headlines almost every single day? Clearly, we're massively overestimating the amount of effort and intelligence invested by spammers.

With that in mind, what follows is a short list of 17 mistakes I routinely see, all of which immediately guarantee that an email is malicious. There are others, but these are the main ones. If this list reflects the mistakes found in the spam behind the headlines, then the size yet lack of sophistication of the problem should become apparent.

1.    No Subject Header

This error is particularly prevalent in ransomware campaigns. Messages whose payloads have very low VirusTotal scores are being sent with no subject header. Maybe the sender thinks it'll pique the curiosity of the recipient, but it should also alert spam filters even before they examine the attachment.

2.    No Set Dressing

Look at any real communication from a bank, PayPal, a store, etc. It is well formatted, the HTML is clean, the language is clear, and the branding is obvious. Legitimate companies and banks don’t tend to send important messages in plain text.

3.    Generic Companies

Generic companies are rare but I do occasionally see them. Who is "the other financial institution" and why has it refused my transaction? Vague, instantiated company names like this, with an accompanying attachment, are clear indicators of spam.

4.    Multiple Recipients

This is another example of laziness on the part of spammers. OK, they may have found an open relay to willingly spread messages rather than buy extra time on a botnet, but anything other than a one-to-one sender to recipient ratio should be an instant red flag.

5.    Poor Salutation

Much apparently personalised spam doesn’t use a competent salutation, or uses a salutation that is simply the user name part of the email address (i.e.: "Dear fred.smith"). It would take effort to code a script that personalises the messages by stripping off the first name and capitalising the initial. Effort is the enemy of the fast buck.

6.    No Body Text

Sending an email with a tantalizing subject header such as "Overdue – Please Respond!" but no body text explaining what or why it's overdue is as common in commodity ransomware as having no subject header. The attack again relies entirely on the natural curiosity of the recipient, who can and should simply ignore it. Spam filters should also take a keen interest.

7.    Auto-translated Body Text

Machine translation has the amusing habit of mapping the grammar of one language onto another, resulting in errors that no native speaker would ever make. Manual translation by a highly fluent speaker is far superior to machine translation, but the translator must also have knowledge of the subject matter for his text to appear convincing. Again, this is effort.


8.    The Third Person

This is a great example of a spam writer trying to distance himself from his crime. "PayPal has detected an anomaly in your account" and "they require you to log in to verify your account" just look weird in the context of a security challenge. This is supposed to be from PayPal, isn't it?

9.    Finger Trouble

I'm fast concluding that some cybercriminals really do wear thick leather gloves while typing, just like in the pictures. Either that or they're blind drunk. Random punctuation marks and extra characters that look like they've been hit at the same time as the correct ones don't make a good impression. Simply rejecting emails that have more than a certain percentage of spelling mistakes might prevent many of these messages from getting through.


10.    Unexpected Plurals and Tenses

Using "informations" instead of "information" is a dead giveaway for spam and should be blocked when in combination with other indicators. Phrases such as "we detect a problem" instead of "we detected a problem" also stick out a mile.


11.    Missing Definite Article

Many spam emails stand out as somehow "wrong" because they miss out the definite article. One recent example I saw read: "Access is blocked because we detect credit card linked to your PayPal account has expired." An associated Yandex.ru return address gave the whole thing a distinct whiff of vodka.

12.    The Wrong Word

"Please review the document and revert back to us immediately". Revert? Really? Surely, you mean "get back", not "revert back". It may be difficult for spam filters to weed out this kind of error, but humans should spot it without difficulty.

13.    Misplaced Emphasis

Unusually capitalised phrases such as "You must update Your details to prevent Your Account from being Suspended" look weird. Initial capitalisation isn't used for emphasis in English sentences, and hints at someone trying to make the message sound more official and urgent than it is.






14.    Tautological Terrors

"It is extremely mandatory that you respond immediately". Not just mandatory but extremely mandatory? Wow, I'd better click that link right away! Urgent calls to action like this overplay the importance of the message in ways that mark them out as fake.








15.    Grandiosity

Using grand words where normal ones should appear to make a message sound more authoritative are a dead giveaway.  Here's an example from last September when a gang famously tried to distribute malware on the back of a new media player release: "To solemnise the release of our new software". Solemnise means to mark with a formal ceremony.

What they really meant was: "To mark the release of our new software".  The whole message was also riddled with the most outrageous auto-translate errors that it made difficult reading.

16.    Overly-grand Titles

Why would the Microsoft Chief Support Manager be contacting me personally all the way from the US to give me a refund? Wouldn't he delegate this important work to a local minion? Similarly, the head of the IMF doesn’t usually spend their days emailing strangers about ATM cards stacked high with cash.


17.    Obfuscated URLs

If the collar doesn't match the cuffs, it's a lie. In other words, if the message contains the name of a high-street bank (for example) and a URL from a shortening service such as bit.ly, spam filters should be blocking the message without question, regardless of the rest of the content.



1 comment:

  1. I'm not sure you're entirely right about the "lazy, incompetent" thing, at least not all the time. I've a strong suspicion that a lot of spammers deliberately use shoddy spelling, grammar, formatting etc as a technique to weed out people who are able to spot spammy signals.

    The sort of person who would see an email from Dave, Security King at Lloddy's Bank, and NOT immediately think "Scam!", is exactly the sort of person the spammer is targeting - the weakest link, the least informed, the least on-the-ball, basically the most vulnerable.

    Those who can't spot this stuff are much more likely to click on links, fill in passwords on dodgy clone sites, or send cash to pay the fees to free up all that gold in Zimbabwe. The spammers aren't interested in the smart people who can see them coming a mile off, and carefully craft their spams to filter those people out.

    At least, that's what I reckon.

    ReplyDelete